I am looking at our patch management control for SQL Server databases and until now the process only requires us to install Security patches. Microsoft releases Cumulative updates every month and it has got fixes for bugs and we have not installed these CU's unless we have hit a bug address in the CU or we think a bug fix for performance issue might help us.
During the last audit the auditors asked us why we haven't installed the CU's.
Now my questions is, does anything in SOC tells us to install anything other than security fixes. CU's contain bugfixes/improvements etc and I am not sure if SOC 1 or 2 defines those or the auditors were mistaken. Isnt it similar to asking us why we havent installed the latest version of SQL Server?